qhwin Privacy Policy

1 Introduction

This Privacy Policy ("Policy") describes how qhwin ("we," "us," or "our"), the operator of the online gaming platform accessible at qhwin.app ("the Platform"), collects, uses, stores, shares, and protects the personal data of users ("you," "your," or "the Data Subject") who access or use the qhwin platform.

qhwin is committed to full compliance with Republic Act No. 10173, the Data Privacy Act of 2012 of the Philippines ("DPA"), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission ("NPC"). Where applicable, qhwin also observes the data protection principles of PAGCOR's regulatory framework.

By registering an account, using the qhwin Login, depositing funds, or otherwise accessing the Platform, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use the qhwin platform.

This Policy should be read together with qhwin's Terms & Conditions and Responsible Gaming Policy, which together form the complete agreement governing your use of the Platform.

2 Personal Data We Collect

qhwin collects the following categories of personal data, depending on how you interact with the Platform:

2.1 Identity & Contact Data

• Full legal name (as it appears on your government-issued ID);
• Date of birth (to verify you are 21 years of age or older);
• Nationality and country of residence;
• Email address and mobile phone number;
• Residential address (barangay, city/municipality, province, ZIP code).

2.2 Identity Verification (KYC) Data

• Government-issued photo ID (Philippine passport, driver's licence, SSS/UMID card, PhilSys National ID, or equivalent);
• Proof of address documents (utility bill, bank statement, or similar);
• Selfie or liveness check image for biometric verification purposes;
• Source of funds documentation where required by PAGCOR or AMLA regulations.

2.3 Financial Data

• Payment method details (GCash account number, Maya account, bank account details, or debit card details — stored only to the extent necessary for transaction processing);
• Transaction history, including deposit amounts, withdrawal requests, and bonus credits;
• Account balance and wagering history.

2.4 Technical & Usage Data

• IP address and approximate geolocation;
• Device type, operating system, and browser information;
• Session logs, including login timestamps and session duration;
• Game play history, including games played, wagers placed, and outcomes;
• Clickstream data and navigation patterns within the Platform.

2.5 Communications Data

• Records of your communications with qhwin customer support (chat transcripts, email correspondence);
• Feedback, survey responses, and promotional opt-in preferences.

3 How We Collect Your Data

qhwin collects personal data through the following means:

• Directly from you: When you register an account via qhwin Login, complete KYC verification, make a deposit or withdrawal, contact customer support, or participate in a promotion;
• Automatically: Through cookies, web beacons, and similar tracking technologies when you browse or use the Platform (see Section 7 for details);
• From third parties: From identity verification service providers, payment processors (GCash, Maya, banks), fraud prevention services, and PAGCOR where required for regulatory compliance;
• From publicly available sources: Where necessary for fraud prevention or regulatory compliance, qhwin may cross-reference publicly available information.

4 How We Use Your Personal Data

qhwin processes your personal data for the following specific purposes:

qhwin will not use your personal data for any purpose that is incompatible with the purposes listed above without first obtaining your explicit consent or as otherwise required by law.

5 Legal Basis for Processing

Under the Data Privacy Act of 2012, qhwin processes your personal data on the following legal bases:

• Contractual necessity: Processing required to fulfil our obligations under the qhwin Terms & Conditions (account management, payment processing, game provision);
• Legal obligation: Processing required to comply with PAGCOR regulations, the Anti-Money Laundering Act, the Data Privacy Act, and other applicable Philippine laws;
• Legitimate interests: Processing for fraud prevention, platform security, and responsible gaming monitoring, where our legitimate interests are not overridden by your rights;
• Consent: Processing for marketing communications and personalised promotions, where you have given explicit, freely given, specific, and informed consent. You may withdraw this consent at any time by contacting [email protected].

6 Data Sharing & Disclosure

qhwin does not sell, rent, or trade your personal data to third parties for their own commercial purposes. We share your data only in the following limited circumstances:

6.1 Service Providers

qhwin engages trusted third-party service providers who process data on our behalf under strict data processing agreements, including:

• Identity verification and KYC providers;
• Payment processors (GCash, Maya, Philippine banks);
• Cloud hosting and infrastructure providers;
• Customer support platform providers;
• Fraud detection and cybersecurity services.

All service providers are contractually bound to process your data only as instructed by qhwin and to maintain appropriate security standards.

6.2 Regulatory & Legal Disclosure

qhwin may disclose your personal data to regulatory and law enforcement authorities where required by law or where we have a good-faith belief that disclosure is necessary to:

• Comply with PAGCOR reporting obligations or NPC directives;
• Comply with Anti-Money Laundering Council (AMLC) reporting requirements;
• Respond to a valid court order, subpoena, or legal process issued by a Philippine court or authority;
• Protect the rights, property, or safety of qhwin, its users, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of qhwin's assets, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the applicable privacy terms before your data is subject to a different privacy policy.

7 Cookies & Tracking Technologies

qhwin uses cookies and similar tracking technologies to operate the Platform, remember your preferences, and analyse usage patterns. The following types of cookies are used:

Strictly necessary cookies cannot be disabled as they are essential for the Platform to function. You may manage your preferences for functional, analytics, and marketing cookies through your account settings or browser controls. Note that disabling certain cookies may affect the functionality of the qhwin platform.

8 Data Retention

qhwin retains your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Philippine law. The following general retention periods apply:

• Account and KYC data: Retained for the duration of your account and for a minimum of five (5) years after account closure, in compliance with PAGCOR and AMLA requirements;
• Financial transaction records: Retained for a minimum of five (5) years from the date of the transaction, as required by the Anti-Money Laundering Act;
• Customer support communications: Retained for three (3) years from the date of the last interaction;
• Marketing preferences and consent records: Retained until you withdraw consent or for three (3) years from the last interaction, whichever is earlier;
• Technical and usage logs: Retained for up to twelve (12) months, after which they are anonymised or deleted.

When personal data is no longer required, qhwin will securely delete or anonymise it in accordance with our data disposal procedures.

9 Data Security

qhwin implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your device and the qhwin platform;
• AES-256 encryption for sensitive data stored at rest, including KYC documents and financial records;
• Multi-factor authentication for all qhwin staff accessing personal data systems;
• Role-based access controls ensuring that only authorised personnel can access personal data, and only to the extent necessary for their role;
• Regular penetration testing and vulnerability assessments conducted by independent cybersecurity specialists;
• 24/7 security monitoring with automated alerts for suspicious access patterns;
• Secure data centres with physical access controls, CCTV, and environmental protections.

10 Your Rights as a Data Subject

Under the Data Privacy Act of 2012, you have the following rights with respect to your personal data held by qhwin:

• Right to be Informed: The right to know what personal data qhwin collects about you and how it is processed — which is the purpose of this Policy;
• Right of Access: The right to request a copy of the personal data qhwin holds about you;
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data;
• Right to Erasure / Right to be Forgotten: The right to request deletion of your personal data, subject to qhwin's legal retention obligations under PAGCOR and AMLA regulations;
• Right to Object: The right to object to the processing of your personal data for direct marketing purposes or where processing is based on legitimate interests;
• Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format;
• Right to Lodge a Complaint: The right to lodge a complaint with the National Privacy Commission (NPC) if you believe your data rights have been violated.

To exercise any of these rights, please contact qhwin's Data Protection Officer at the details provided in Section 14. We will respond to all verified data subject requests within thirty (30) days of receipt. In complex cases, this period may be extended by a further thirty (30) days, with notice to you.

11 Children's Privacy

If you are a parent or guardian and believe that a person under 21 has registered on the qhwin platform, please contact us immediately at [email protected] so that we can take appropriate action. qhwin takes underage gambling extremely seriously and cooperates fully with PAGCOR's underage gambling prevention initiatives.

12 International Data Transfers

qhwin's primary operations and data storage are based in the Philippines. However, some of our third-party service providers (such as cloud infrastructure providers and KYC verification services) may process data in other countries. Where such transfers occur, qhwin ensures that:

• The recipient country provides an adequate level of data protection, as recognised by the NPC;
• Appropriate contractual safeguards are in place, such as standard contractual clauses approved by the NPC;
• The transfer is strictly limited to what is necessary for the specific service being provided.

qhwin will not transfer your personal data to a jurisdiction that does not provide adequate data protection without your explicit consent or a valid legal basis under the Data Privacy Act.

13 Updates to This Privacy Policy

qhwin may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or regulatory requirements. When material changes are made, we will notify registered users by email and/or by posting a prominent notice on the Platform at least fourteen (14) days before the changes take effect.

The "Effective Date" at the top of this Policy indicates when the current version came into force. We encourage you to review this Policy periodically. Your continued use of the qhwin platform after the effective date of any updated Policy constitutes your acceptance of the revised terms.

Previous versions of this Privacy Policy are available upon request by contacting our Data Protection Officer.

14 Contact & Data Protection Officer

qhwin has appointed a Data Protection Officer ("DPO") in accordance with the requirements of the Data Privacy Act of 2012 and the NPC's registration requirements. If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact our DPO:

If you are not satisfied with qhwin's response to your data privacy concern, you have the right to lodge a complaint with the National Privacy Commission (NPC) of the Philippines through their official channels.